Circular to Credit and Financial Institutions on amendments to Banking Rule BR/14

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Circular to Credit and Financial Institutions on amendmentsto Banking Rule BR/14 The Authority is hereby issuing a revised version of Banking Rule BR/14 on Outsourcing by Credit Institutions Authorised under the Banking Act 1994 Amendments to the Rule The Rule is being wholly revised to implement the EBA Guidelines on Outsourcing Arrangements introduce the procedure for credit institutions to notify the Authority of material services or activities that they intend to outsource, pursuant to Article 19A(1) of the Banking Act. The revised Rule includes amendments to the set of criteria in order for credit institutions to determine whether an arrangement falls within the definition of outsourcing, and amendments to the list of considerations to be made in assessing whether the services or activities to be outsourced are material. Where an outsourcing arrangement is considered to be material, credit institutions are obliged to notify the Authority pursuant to Article 19A(1) of the Banking Act. In this regard, the revised Rule lays down the notification procedure established by the Authority. Credit institutions shall notify the Authority at least 60 days prior to conferring the outsourcing activity or service by submitting the information listed in the Rule together with any other information as the Authority may deem necessary. In line with the EBA Guidelines, the Rule provides requirements on the credit framework in relation to outsourced activities and on the outsourcing policy. Credit institutions are obliged to appropriately assess the relevant risks and conduct due diligence on the service provider. Additionally, the Rule sets out requirements in relation to the termination of the outsourcing arrangement and the documentation of an exit strategy by credit institutions. Further to the above, Part 4 of the Rule then establishes that all requirements laid out in the Rule are subject to the principle of proportionality taking into account the credit organization, and nature of its activities. Repeal of Annex I to the Rule The previous Annex I to BR/14 on outsourcing to cloud service providers, which implemented the EBA Recommendations (EBA/REC/2017/03), is being repealed since the requirements on cloud outsourcing have been integrated with the revised Rule. 4 June 2020

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Applicability to Financial Institutions In view of paragraph 51A of the Financial Institutions Rule FIR/01 on Application Procedures and Requirements for Authorisation of Licences under the Financial Institutions Act 1994, financial institutions are also being guided to verify that outsourcing agreements are drawn up on the requisites of BR/14. The revised Banking Rule BR/14 will come into force with immediate effect. Any queries in relation to the above should be directed to Banking Supervision (Policy Section) on bsupolicy@mfsa.mt.